What It Means: New Healthcare AI Rules
New transparency and oversight expectations for clinical AI are reaching vendors first. Practices will still need to document how each tool is used, reviewed, and disclosed.
CareScope Editorial/September 4, 2026/2 min read
The short version
- The direction of travel is disclosure and human oversight, not prohibition.
- Most obligations attach to developers and certified systems — but practices inherit the documentation.
- Two artifacts cover most of what anyone will ask for: an AI inventory and a written oversight process.
Why it matters
You are unlikely to be told to stop using AI. You are increasingly likely to be asked what you use, what it touches, and who checks it. Practices that cannot answer will spend the difference in staff hours during an audit, a payer review, or a cyber insurance renewal.
What is actually changing
Regulators and certification bodies are converging on a simple posture: AI used in care should be identifiable, its limits should be documented, and a qualified human should remain accountable for decisions. The heavy technical obligations sit with the companies building the models and the certified health IT platforms embedding them.
Where that lands on a practice
Three places, all administrative:
- You are expected to know which of your systems include AI features. Many practices have them switched on inside the EHR without having decided to.
- You are expected to be able to describe the human review step. "The clinician signs the note" is a legitimate answer when it is written down and true.
- You are expected to handle patient-facing disclosure sensibly where AI touches communication or documentation.
The two documents that answer most questions
An AI inventory: tool, vendor, what data it sees, whether a business associate agreement exists, who approved it. One page, one table.
An oversight statement: for each tool, who reviews output before it counts, and what happens when it is wrong. Also one page.
Nothing here requires a consultant. It requires a decision about who is accountable, written down before someone asks.
The CareScope take
Build the inventory now while it is a thirty-minute task. Once features are enabled across a couple of platforms and staff have adopted tools informally, the same exercise turns into a project.
Do not wait for final rules before writing the oversight statement. Every version of these requirements asks the same underlying question, and the answer is yours to define.
Sources
- HTI-1 Final Rule — ASTP/ONC
- Health Data, Technology, and Interoperability final rule (89 FR 1192) — Federal Register
- AI/ML-Enabled Medical Devices — U.S. Food and Drug Administration
CareScope cites primary sources — regulators, standards bodies, and published research — wherever a claim depends on them. Reporting is editorially independent and is not legal advice.
policy · governance · ai
